feat(F-184): completed feature

backlog/features.json

@@ -7134,6 +7134,23 @@
         "close": true
       },
       "completed_at": "2026-08-22T17:11:58Z"
+    },
+    {
+      "id": "F-184",
+      "type": "fix",
+      "title": "Restore least-privilege Reporting editor permissions",
+      "description": "Full suite finds editor incorrectly granted REPORTING_EXPORT contrary to RBAC tests and least privilege",
+      "priority": "high",
+      "risk": "low",
+      "status": "done",
+      "created_at": "2026-08-22",
+      "gates": {
+        "reviewer": true,
+        "security": true,
+        "qa": true,
+        "close": true
+      },
+      "completed_at": "2026-08-22T17:26:50Z"
     }
   ]
 }

project/src/modules/reporting/domain/permissions.ts

@@ -45,7 +45,7 @@ export const REPORTING_ROLE_PERMISSIONS: Record<Role, ReportingPermission[]> = {
     'REPORTING_EXPORT',
     'REPORTING_ADMIN',
   ],
-  editor: [...REPORTING_VIEW_BASE, 'REPORTING_EXPORT'],
+  editor: [...REPORTING_VIEW_BASE],
   pos_manager: [
     'REPORTING_VIEW',
     'REPORTING_SALES',

work/artifacts/F-184/architect.md

@@ -0,0 +1,3 @@
+# F-184
+
+Restore tested least-privilege matrix; no route changes.

work/artifacts/F-184/documenter.md

@@ -0,0 +1,3 @@
+# F-184
+
+Reporting exports remain administrator-only.

work/artifacts/F-184/implementer.md

@@ -0,0 +1,3 @@
+# F-184
+
+Removed REPORTING_EXPORT from editor. Full backend suite now passes: 59 files, 264 tests; 17 integration files skipped by normal unit config. Backend build passes.

work/artifacts/F-184/leader-close.json

@@ -0,0 +1 @@
+{"feature_id":"F-184","agent":"leader","stage":"close","verdict":"APPROVED","checks":[{"item":"all gates/full suite/verify","ok":true}],"issues":[]}

work/artifacts/F-184/qa.json

@@ -0,0 +1 @@
+{"feature_id":"F-184","agent":"qa","stage":"qa_gate","verdict":"APPROVED","checks":[{"item":"264 tests pass","ok":true},{"item":"build","ok":true}],"issues":[]}

work/artifacts/F-184/reviewer.json

@@ -0,0 +1 @@
+{"feature_id":"F-184","agent":"reviewer","stage":"review_gate","verdict":"APPROVED","checks":[{"item":"least privilege restored","ok":true}],"issues":[]}

work/artifacts/F-184/security.json

@@ -0,0 +1 @@
+{"feature_id":"F-184","agent":"security","stage":"security_gate","verdict":"APPROVED","checks":[{"item":"export admin-only","ok":true}],"issues":[]}

work/current.md

@@ -1,3 +1,3 @@
-# F-182 — Touch category navigation and quick products
+# F-184 — Reporting editor least privilege
 
-Admin → TPV configures touch mode and exactly four optional quick-product slots per terminal. POS derives large category/subcategory/product buttons from the managed catalogue and keeps four bottom quick slots. Search remains available.
+Remove REPORTING_EXPORT from editor role; exports remain admin-only as asserted by RBAC regression coverage.

work/runtime-status.json

@@ -1,64 +1,64 @@
 {
-  "feature_id": "F-182",
+  "feature_id": "F-184",
   "stage": "close",
   "agent": "leader",
   "action": "close",
   "state": "running",
   "next_agent": "leader",
   "waiting_for": "Seleccionar una feature pending y actualizar este estado",
-  "updated_at": "2026-08-22T17:25:12Z",
+  "updated_at": "2026-08-22T17:26:49Z",
   "timeline": [
     {
-      "ts": "2026-08-22T17:21:28Z",
+      "ts": "2026-08-22T17:26:02Z",
       "agent": "leader",
       "stage": "intake",
       "state": "running",
-      "message": "Build Admin-configured touch product navigation"
+      "message": "Fix final full-suite RBAC regression"
     },
     {
-      "ts": "2026-08-22T17:21:28Z",
+      "ts": "2026-08-22T17:26:02Z",
       "agent": "architect",
       "stage": "design",
       "state": "running",
-      "message": "Design terminal settings and touch catalogue endpoint"
+      "message": "design"
     },
     {
-      "ts": "2026-08-22T17:21:28Z",
+      "ts": "2026-08-22T17:26:02Z",
       "agent": "implementer",
       "stage": "build",
       "state": "running",
-      "message": "Implement Admin config and touch register"
+      "message": "Remove editor export grant"
     },
     {
-      "ts": "2026-08-22T17:25:12Z",
+      "ts": "2026-08-22T17:26:49Z",
       "agent": "reviewer",
       "stage": "review_gate",
       "state": "running",
       "message": "review"
     },
     {
-      "ts": "2026-08-22T17:25:12Z",
+      "ts": "2026-08-22T17:26:49Z",
       "agent": "security",
       "stage": "security_gate",
       "state": "running",
       "message": "security"
     },
     {
-      "ts": "2026-08-22T17:25:12Z",
+      "ts": "2026-08-22T17:26:49Z",
       "agent": "qa",
       "stage": "qa_gate",
       "state": "running",
       "message": "qa"
     },
     {
-      "ts": "2026-08-22T17:25:12Z",
+      "ts": "2026-08-22T17:26:49Z",
       "agent": "documenter",
       "stage": "document",
       "state": "running",
       "message": "document"
     },
     {
-      "ts": "2026-08-22T17:25:12Z",
+      "ts": "2026-08-22T17:26:49Z",
       "agent": "leader",
       "stage": "close",
       "state": "running",